Website Security

[gauravweb]

http://www.risingfaizabad.com/article-view.php?id= <-- vulnerable to SQL injection
http://www.risingfaizabad.com/category.php?id=aaa <-- something is going on there, not sure what

The error on these pages are just header change request and I know about it. However I have edited both the pages. The most important thing for me is how could he get my password.?

[Goatboy]

http://www.risingfaizabad.com/article-view.php?id= <-- vulnerable to SQL injection
http://www.risingfaizabad.com/category.php?id=aaa <-- something is going on there, not sure what

The error on these pages are just header change request and I know about it. However I have edited both the pages. The most important thing for me is how could he get my password.?

If you want us to really be able to help you, it would be nice to see some source code. Although the attacker was able to get in (presumably) without it, we would be much more able to help if we could see exactly what is going on behind the scenes.

I know you may be reluctant to do this, and that is entirely understandable. However, I can only say that full transparency is often the way to go in security review

[gauravweb]

http://www.risingfaizabad.com/article-view.php?id= <-- vulnerable to SQL injection
http://www.risingfaizabad.com/category.php?id=aaa <-- something is going on there, not sure what

The error on these pages are just header change request and I know about it. However I have edited both the pages. The most important thing for me is how could he get my password.?

If you want us to really be able to help you, it would be nice to see some source code. Although the attacker was able to get in (presumably) without it, we would be much more able to help if we could see exactly what is going on behind the scenes.

I know you may be reluctant to do this, and that is entirely understandable. However, I can only say that full transparency is often the way to go in security review

I can give you the source code but first tell me which code do you want? And as I have mentioned before, the most important concern for me is how he can get the password of my account?

[Goatboy]

We've already listed some ways he could have gotten in, but there are many, and they are all just guesses. We probably can't tell you exactly how he got in, but if we had the source we could review it and narrow it down. From there, we could tell you what to fix, and maybe even how to fix it.

That said, it would be the most helpful to have full source. I realize this is not always legally possible or personally desirable. In that case, we should at least see the scripts which handle logins.

The bottom line is, you're going to get more help if you give us more to work with.

[gauravweb]

We've already listed some ways he could have gotten in, but there are many, and they are all just guesses. We probably can't tell you exactly how he got in, but if we had the source we could review it and narrow it down. From there, we could tell you what to fix, and maybe even how to fix it.

That said, it would be the most helpful to have full source. I realize this is not always legally possible or personally desirable. In that case, we should at least see the scripts which handle logins.

The bottom line is, you're going to get more help if you give us more to work with.

Okay then I'm sending you the code as PM.

[Goatboy]

>_<

That's not what I meant, but okay. Should I share it with thedotmaster as well?

[gauravweb]

>_<

That's not what I meant, but okay. Should I share it with thedotmaster as well?

Me and thedotmaster are already working on this. However you can share this with him too.